PfBlockerNG v2.1 w/TLD

BBcan177

The TLD feature is used by pfBlockerNG DNSBL for Domain blocking via the Unbound DNS Resolver.

When "TLD" is enabled… It checks each Domain to see what the TLD (Top-Level domain) is for each listed Domain in the DNSBL Blacklist Feeds... then if there is one more level, it will block the whole Domain since its the root Domain name....

When Feeds do not post the Full-Domain, then only the listed Sub-Domains are blocked...
ie: ads.yahoo.com Will ony block that Sub-Domain and not yahoo.com

Example 1:
download.101com.com

com - Top-Level Domain
101com.com - Second-level Domain
download.101com.com - Third-level Domain

Example 2:
example.uk.com

uk.com - Top-Level Domain
example.uk.com - Second-Level Domain

The DNSBL database is located at /var/unbound/pfb_dnsbl.conf

When TLD is enabled, in that conf file you will see "transparent" zones, which means its only blocking the actual Domains listed… None of the Sub-Domains are blocked...

Scroll down that file, and look for lines that have "redirect" zones, which means its blocking the full Domain and all Sub-Domains…

You can also block whole TLD(s) like | cn | ru | pw | xyz | etc…. Option also exist to Whitelist specific Domains when the whole TLD is being blocked.

The following Unbound documentation has additional detail on the "Local-zone" configuration:
https://unbound.net/documentation/unbound.conf.html

someuser123

YeY ;D :D :) ;) huge update, awesomeness cant wait for this update, thanks for all your hard work….

brandur

Sounds like a very exciting update :D
Thank you

Pippin

Very nice addition, chapeau 8)

pftdm007

Cant wait for this update to roll out!!!!!

zerodamage

Is this available to install now? I am only showing version 2.0.17 for update. I uninstalled hoping maybe I would then see the updated version but it's still not there.

As a matter of fact, it says "Not Ready" in the update window when trying to install or update it now. I now do not have it installed and am not able to install it but my system says it is installed.

It actually did install but only to version 2.0.17. Is that right?

BBcan177

https://twitter.com/pfsense/status/755227123187449856

BBcan177

The latest version of pfBlockerNG v2.1.1_1 has been reviewed and merged into pfSense 2.3.3 Dev. If your on the 2.3.3 Snapshots, its available to be installed now.

I believe that the Devs will merge it for pfSense 2.3.2 shortly, so stay tuned for the update.

If you have any questions or Feedback, please let me know….

Please Read the instructions in the DNSBL tab for the new TLD feature before enabling it.
Once enabled, follow that with a "Force Reload - DNSBL".

Review any MaxMind GeoIP settings, since there have been significant changes with the upgrade to GeoLite2.

Note: If you have less than 5GB of RAM and you have added the Bambenek DGA DNSBL Feed, please move that to the last entry in the DNSBL Feeds. Since that feed is quite large (700k+ Domains), its best to allow TLD to process the other Feeds first before hitting the max TLD Domain limit. (http://osint.bambenekconsulting.com/feeds/dga-feed.gz).

f34rinc

Nice work BBcan177 :D setup blocking of .ru as a test and it works.

DownloadDeviant

THANKS! Can't wait! Good stuff….great work...and thanks for helping us dumb dumbs :P here and over at Reddit!

PS - is there a quick n dirty way to test PFBNG to be sure you've generally set it up correctly? Like going to a website and not seeing ads, etc.?

mauroman33

Thank you so much for this fantastic work!!!

BBcan177

@DownloadDeviant:

THANKS! Can't wait! Good stuff….great work...and thanks for helping us dumb dumbs :P here and over at Reddit!

PS - is there a quick n dirty way to test PFBNG to be sure you've generally set it up correctly? Like going to a website and not seeing ads, etc.?

Thanks… Are you on the latest 2.1.1_1 version? Haven't heard much feedback yet, so not sure if many have installed it yet...

Not sure what sites are the worst for ADs... but yahoo is probably up there....

@mauroman33:

Thank you so much for this fantastic work!!!

Thanks!

DownloadDeviant

@BBcan177:

Thanks… Are you on the latest 2.1.1_1 version? Haven't heard much feedback yet, so not sure if many have installed it yet...

Not sure what sites are the worst for ADs... but yahoo is probably up there....

I'm still on 2.0.17. I've slowed down my updating a bit since I've had some snags and had to rebuild 3 times in the past 7 weeks. Two were my fault…lol I thought I had router plugged into the battery port on the UPS but didn't...storm hit...lost power...pf went corrupt. Sooooooooo, I'm a bit worn out on tampering right now. lol That said, I'll probably upgrade it this weekend.

Yahoo it is then. I'm very new to pfBNG so I need to learn it and get comfortable. I don't want to get too aggressive. I just want it to serve as a companion for my Firefox plugins and to help keep my girlfriend protected.

someuser123

pfBlockerNG-2.1.1_1 is working like charm, On 2.3.3-DEVELOPMENT (amd64) no issues.

TLD Blacklist is really handy, Thanks BBcan177

BBcan177

Here are the links for Malware Corpus Tracker which can be used w/ pfBlockerNG DNSBL:

Site:
http://track.h3x.eu/about/400

Available Feeds:
https://tracker.h3x.eu/api/sites_1month.php
https://tracker.h3x.eu/api/sites_1week.php
https://tracker.h3x.eu/api/sites_1day.php
https://tracker.h3x.eu/api/sites_1hour.php

DO NOT Select all of these Feeds. You should pick only one Feed. For example: the "1Month" will include the "1Week/1Day/1Hour".

[ Edit - change to https ]

Twitter:
https://twitter.com/h3x2b

ntct

Hi BBcan177,

I can't update h3x feed from available feeds list in pfBlockerNG v2.1.

It show below.

[ h3x ]			 Downloading update .. 200 OK
 Remote timestamp missing 
 No Domains Found

And I can't let TLD Exclusion List working. Can you give a example or check it works?

RonpfS

@ntct:

Hi BBcan177,

I can't update h3x feed from available feeds list in pfBlockerNG v2.1.

It show below.
[ h3x ]			 Downloading update .. 200 OK
 Remote timestamp missing 
 No Domains Found

Same here

@ntct:

And I can't let TLD Exclusion List working. Can you give a example or check it works?

Did you do a Force Reload after changing the list ?

hulleyrob

[ 1month ]		 Downloading update .. 200 OK
  Remote timestamp missing 
 No Domains Found

[ 1week ]		 Downloading update [ 07/30/16 12:31:20 ] .. 200 OK
  Remote timestamp missing 
 No Domains Found

[ 1day ]		 Downloading update .. 200 OK
  Remote timestamp missing 
 No Domains Found

[ 1hour ]		 Downloading update .. 200 OK
  Remote timestamp missing 
 No Domains Found

Me three, anyone post how exactly you get these list working?

BBcan177

Here is a patch to fix the H3X Feed… Sorry about that ...

@BBcan177:

Here are the links for Malware Corpus Tracker which can be used w/ pfBlockerNG DNSBL:

UPDATE:

Guess the internal QA testing didn't work too well when I tested this Feed.
Please follow these instructions below to patch the code to get the following feed to parse:

Edit /usr/local/pkg/pfblockerng/pfblockerng.inc

Goto Line 3368 which contains the following:
$h3x_feed = TRUE;
Reference:
https://github.com/pfsense/FreeBSD-ports/blob/devel/net/pfSense-pkg-pfBlockerNG/files/usr/local/pkg/pfblockerng/pfblockerng.inc#L3368

and add the following line after line 3368:
$liteparser = TRUE;
Then follow that with a "Force Update"

BBcan177

@ntct:

And I can't let TLD Exclusion List working. Can you give a example or check it works?

Can you provide more detail about what you're trying to accomplish?